I made a thread in German today, but this fits here well so I translated it with Deepl. Enjoy.
Consistently cyber-secure behaviour is not a question of knowledge, nor is it a fault on the part of the user.
Systems that require flawless behaviour at all times will fail sooner or later.
Yes, this is going to be a lengthy thread about the Berlin hack. Leave your schadenfreude at the door, grab a
drink and take a seat.
What happened?
Someone, either via a Google search or a phishing email, lured at least one member of staff onto a fake website, where they were presented with a CAPTCHA or Cloudflare Turnstile. This displayed instructions on how to complete the verification:
Press the following keys:
• Win + x
• i
• Ctrl + v
• Enter
Before these instructions appeared, the users had already clicked a button that copied something to the clipboard in the background. Win+x opens the Quick Access menu, i opens the terminal, Ctrl+v pastes the command from the clipboard, and Enter executes it.
From this point onwards, several technical methods are available, none of which are relevant to this thread.
The whole thing is called TerminalFix, a variant of ClickFix. ClickFix has been around for about 2.5 years and continues to grow in scope, both on the technical side and in terms of social engineering, with ever-new variants.
The attack capitalises on mimicking familiar procedures, usually creating a problem under apparent time pressure, which can then be resolved using unusual but not implausible methods. Yes, he’s just said that, and I know a lot of IT people are already gnashing their teeth and digging out all those Layer8-PEBCAK-WeakestLink one-liners from their drawers that I haven’t heard yet.
For most people, the damned technology is simply supposed to work; it often doesn’t, and then some obscure instructions appear ‘that you don’t understand anyway’; information isn’t read anymore because everyone has been trained by CAPTCHAs, cookie banners and Windows set-up to just click ‘Next’ over and over. Deal with it: it’s become normal to follow instructions ‘from the computer’. Organisations need to be prepared for this.
People make mistakes. That’s normal. Organisations need to be prepared for this.
People don’t seek help if they expect to be met with schadenfreude. Organisations …
In Berlin, cyber security isn’t a matter for senior management. That’s the problem: Layer 9.
Blaming the users is a sign of laziness on the part of IT (security) and management.
Oh, one more thing: running TerminalFix wasn’t the only problem. uBlock Origin warns against ClickFix-style attacks, as do many other tools. Terminal, PowerShell, the Run dialogue and macros can be blocked via policy. EDR could have intervened and triggered a response. Further lateral movement could have been detected. The data leak could have been spotted sooner than after a week. Suspicious VPN connections could have been flagged. Information security operates in layers here too. The attackers didn’t just have to ‘win once’; they had to overcome many hurdles, some of which, in this case at least, weren’t actually that high.
I’ll leave it at that for now.
Here you can see how ClickFix-style attacks work.
Remember: Now, you’re prepared. In your day-to-day work, you might be in a rush to get something important done, only for it not to work. What’s more, there are already many new variants that don’t even require the Run dialogue or Terminal/PowerShell.
On a related note: there are, of course, sectors where it is perfectly clear that people make mistakes, so systems are designed to take this into account, for example:
• Health and safety on production lines
• Aviation safety
• Nuclear facilities
• Pharmaceuticals
• Chemicals
One could perhaps draw parallels with cybersecurity.